Fortinet black logo

CLI Reference

log setting remote

log setting remote

Use this command to configure storing log messages remotely, on a Syslog server or FortiAnalyzer unit.

Syntax

config log setting remote

edit <log-destination_index>

set comma-separated-value {enable | disable}

set encryption-log-status {enable | disable}

set event-log-category {admin configuration ha | imap pop3 smtp system update webmail}

set event-log-status {enable | disable}

set facility {alert | audit | auth | authpriv | clock | cron | daemon | ftp | kern | local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7 | lpr | mail | news | ntp}

set history-log-status {enable | disable}

set loglevel {alert | critical | debug | emergency | error | information | notification | warning}

set port <port_int>

set protocol {syslog | cftps}

set server <log_ipv4>

set spam-log-status {enable | disable}

set status {enable | disable}

set virus-log-status {enable | disable}

end

Variable

Description

Default

<log-destination_index>

Type an index number to identify which remote Syslog server or FortiAnalyzer unit you are configuring.

No default.

comma-separated-value {enable | disable}

Enable if you want to send log messages in comma-separated value (CSV) format.

Note: Do not enable this option if the log destination is a FortiAnalyzer unit. FortiAnalyzer units do not support CSV format logs.

disable

encryption-log-status {enable | disable}

Enable or disable IBE event logging to a remote Syslog server or FortiAnalyzer unit.

disable

event-log-category {admin configuration ha | imap pop3 smtp system update webmail}

Type all of the log types and subtypes that you want to record to this storage location. Separate each type with a space.

admin: Log all administrative events, such as logins, resets, and configuration updates.

configuration: Enable to log configuration changes.

ha: Log all high availability (HA) activity.

imap: Log all IMAP events.

pop3: Log all POP3 events.

smtp: Log all SMTP relay or proxy events.

system: Log all system-related events, such as rebooting the FortiMail unit.

update: Log both successful and unsuccessful attempts to download FortiGuard updates.

webmail: Log all FortiMail webmail events.

No default.

event-log-status {enable | disable}

Enable or disable event logging to a remote Syslog server or FortiAnalyzer unit.

disable

facility {alert | audit | auth | authpriv | clock | cron | daemon | ftp | kern | local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7 | lpr | mail | news | ntp}

Type the facility identifier that the FortiMail unit will use to identify itself when sending log messages to the first Syslog server.

To easily identify log messages from the FortiWeb unit when they are stored on the Syslog server, enter a unique facility identifier, and verify that no other network devices use the same facility identifier.

kern

history-log-status {enable | disable}

Enable to log both successful and unsuccessful attempts by the built-in MTA or proxies to deliver email.

disable

loglevel {alert | critical | debug | emergency | error | information | notification | warning}

Type one of the following severity levels:

alert

critical

debug

emergency

error

information

notification

warning

This log destination will receive log messages greater than or equal to this severity level.

information

port <port_int>

If the remote host is a FortiAnalyzer unit, type 514. If the remote host is a Syslog server, type the UDP port number on which the Syslog server listens for connections.

514

protocol {syslog | cftps}

Enter the protocol used for remote logging.

syslog

server <log_ipv4>

Type the IP address of the Syslog server or FortiAnalyzer unit.

No default.

spam-log-status {enable | disable}

Enable to log all antispam events.

disable

status {enable | disable}

Enable to send log messages to a remote Syslog server or FortiAnalyzer unit.

disable

virus-log-status {enable | disable}

Enable to log all antivirus events.

disable

Related topics

log setting local

log alertemail recipient

log alertemail setting

log setting remote

Use this command to configure storing log messages remotely, on a Syslog server or FortiAnalyzer unit.

Syntax

config log setting remote

edit <log-destination_index>

set comma-separated-value {enable | disable}

set encryption-log-status {enable | disable}

set event-log-category {admin configuration ha | imap pop3 smtp system update webmail}

set event-log-status {enable | disable}

set facility {alert | audit | auth | authpriv | clock | cron | daemon | ftp | kern | local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7 | lpr | mail | news | ntp}

set history-log-status {enable | disable}

set loglevel {alert | critical | debug | emergency | error | information | notification | warning}

set port <port_int>

set protocol {syslog | cftps}

set server <log_ipv4>

set spam-log-status {enable | disable}

set status {enable | disable}

set virus-log-status {enable | disable}

end

Variable

Description

Default

<log-destination_index>

Type an index number to identify which remote Syslog server or FortiAnalyzer unit you are configuring.

No default.

comma-separated-value {enable | disable}

Enable if you want to send log messages in comma-separated value (CSV) format.

Note: Do not enable this option if the log destination is a FortiAnalyzer unit. FortiAnalyzer units do not support CSV format logs.

disable

encryption-log-status {enable | disable}

Enable or disable IBE event logging to a remote Syslog server or FortiAnalyzer unit.

disable

event-log-category {admin configuration ha | imap pop3 smtp system update webmail}

Type all of the log types and subtypes that you want to record to this storage location. Separate each type with a space.

admin: Log all administrative events, such as logins, resets, and configuration updates.

configuration: Enable to log configuration changes.

ha: Log all high availability (HA) activity.

imap: Log all IMAP events.

pop3: Log all POP3 events.

smtp: Log all SMTP relay or proxy events.

system: Log all system-related events, such as rebooting the FortiMail unit.

update: Log both successful and unsuccessful attempts to download FortiGuard updates.

webmail: Log all FortiMail webmail events.

No default.

event-log-status {enable | disable}

Enable or disable event logging to a remote Syslog server or FortiAnalyzer unit.

disable

facility {alert | audit | auth | authpriv | clock | cron | daemon | ftp | kern | local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7 | lpr | mail | news | ntp}

Type the facility identifier that the FortiMail unit will use to identify itself when sending log messages to the first Syslog server.

To easily identify log messages from the FortiWeb unit when they are stored on the Syslog server, enter a unique facility identifier, and verify that no other network devices use the same facility identifier.

kern

history-log-status {enable | disable}

Enable to log both successful and unsuccessful attempts by the built-in MTA or proxies to deliver email.

disable

loglevel {alert | critical | debug | emergency | error | information | notification | warning}

Type one of the following severity levels:

alert

critical

debug

emergency

error

information

notification

warning

This log destination will receive log messages greater than or equal to this severity level.

information

port <port_int>

If the remote host is a FortiAnalyzer unit, type 514. If the remote host is a Syslog server, type the UDP port number on which the Syslog server listens for connections.

514

protocol {syslog | cftps}

Enter the protocol used for remote logging.

syslog

server <log_ipv4>

Type the IP address of the Syslog server or FortiAnalyzer unit.

No default.

spam-log-status {enable | disable}

Enable to log all antispam events.

disable

status {enable | disable}

Enable to send log messages to a remote Syslog server or FortiAnalyzer unit.

disable

virus-log-status {enable | disable}

Enable to log all antivirus events.

disable

Related topics

log setting local

log alertemail recipient

log alertemail setting